Register | Log in

composer

dependency manager for PHP

Choose email to subscribe with

general

source: composer (main)
version: 2.11.1-1
maintainer: Debian PHP PEAR Maintainers (archive) (DMD)
uploaders: David Prévot (DMD)
arch: all
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2.0.9-2+deb11u4
o-o-sec: 2.0.9-2+deb11u4
oldstable: 2.5.5-1+deb12u5
old-sec: 2.5.5-1+deb12u2
old-p-u: 2.5.5-1+deb12u5
stable: 2.8.8-1+deb13u3
testing: 2.10.3-1
unstable: 2.11.1-1

versioned links

2.0.9-2+deb11u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.5.5-1+deb12u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.5.5-1+deb12u5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.8.8-1+deb13u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.10.3-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.11.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

composer

action needed

2 security issues in trixie high

There are 2 open security issues in trixie.

2 important issues:

TEMP-0000000-4A8BFB:
TEMP-0000000-6A3A68:

5 issues that should be fixed with the next stable update:

CVE-2026-59944: Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3, a malicious or compromised dependency can bypass the earlier CVE-2026-59946 binary-path hardening because Composer validates literal parent-directory segments only during dependency resolution, while the symlink and installed-metadata paths described by the advisory skip that validation. A package can ship an in-package binary symlink that resolves outside its installation directory, or attacker-influenced vendor/composer/installed.json metadata can provide an escaping binary path during a reinstall or regeneration of missing vendor/bin entries. The installed-metadata path is reachable only when the vendor directory was not populated by the same validated install run, such as when it is restored from an untrusted cache, copied from an earlier build stage, carried over from an older Composer run, or writable by a lower-trust build step. Composer can follow the path, change the external target's permissions to make it world-readable and executable, and create a runnable vendor/bin proxy to that external file. The issue does not directly read or transmit data and does not by itself provide remote code execution. This issue is fixed in versions 2.2.30 and 2.10.3.
CVE-2026-59946: Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package install directory and cause Composer's binary installation flow to chmod an existing host file to a world-readable and world-executable mode during composer install, update, or require. This issue is fixed in versions 2.2.29 and 2.10.2.
CVE-2026-59947: Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug output because AuthHelper, Url::sanitize, and ProcessExecutor did not sanitize username-only URL credentials. This issue is fixed in versions 2.2.29 and 2.10.2.
CVE-2026-59948: Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packagist.org or Private Packagist can cause Composer to write attacker-controlled files outside the vendor directory and outside the project during install or update by using an invalid package name that is not correctly validated before dependency-resolution results are written or installed. This issue is fixed in versions 2.2.29 and 2.10.2.
CVE-2026-84361: Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 client was installed and Composer installed the package from source through composer install or composer update, including --prefer-source, Composer\Util\Perforce passed the address to p4 without validation, causing p4 to run a local command with the privileges of the user or CI account. Packagist.org does not permit Perforce source metadata. This issue is fixed in versions 2.2.30 and 2.10.3.

Created: 2026-10-29 Last update: 2026-10-31 01:01

2 security issues in forky high

There are 2 open security issues in forky.

2 important issues:

TEMP-0000000-4A8BFB:
TEMP-0000000-6A3A68:

Created: 2026-10-29 Last update: 2026-10-31 01:01

7 security issues in bookworm high

There are 7 open security issues in bookworm.

7 important issues:

CVE-2026-59944: Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3, a malicious or compromised dependency can bypass the earlier CVE-2026-59946 binary-path hardening because Composer validates literal parent-directory segments only during dependency resolution, while the symlink and installed-metadata paths described by the advisory skip that validation. A package can ship an in-package binary symlink that resolves outside its installation directory, or attacker-influenced vendor/composer/installed.json metadata can provide an escaping binary path during a reinstall or regeneration of missing vendor/bin entries. The installed-metadata path is reachable only when the vendor directory was not populated by the same validated install run, such as when it is restored from an untrusted cache, copied from an earlier build stage, carried over from an older Composer run, or writable by a lower-trust build step. Composer can follow the path, change the external target's permissions to make it world-readable and executable, and create a runnable vendor/bin proxy to that external file. The issue does not directly read or transmit data and does not by itself provide remote code execution. This issue is fixed in versions 2.2.30 and 2.10.3.
CVE-2026-59946: Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package install directory and cause Composer's binary installation flow to chmod an existing host file to a world-readable and world-executable mode during composer install, update, or require. This issue is fixed in versions 2.2.29 and 2.10.2.
CVE-2026-59947: Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug output because AuthHelper, Url::sanitize, and ProcessExecutor did not sanitize username-only URL credentials. This issue is fixed in versions 2.2.29 and 2.10.2.
CVE-2026-59948: Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packagist.org or Private Packagist can cause Composer to write attacker-controlled files outside the vendor directory and outside the project during install or update by using an invalid package name that is not correctly validated before dependency-resolution results are written or installed. This issue is fixed in versions 2.2.29 and 2.10.2.
CVE-2026-84361: Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 client was installed and Composer installed the package from source through composer install or composer update, including --prefer-source, Composer\Util\Perforce passed the address to p4 without validation, causing p4 to run a local command with the privileges of the user or CI account. Packagist.org does not permit Perforce source metadata. This issue is fixed in versions 2.2.30 and 2.10.3.
TEMP-0000000-4A8BFB:
TEMP-0000000-6A3A68:

Created: 2026-07-09 Last update: 2026-10-31 01:01

9 security issues in bullseye high

There are 9 open security issues in bullseye.

7 important issues:

CVE-2026-40176: Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::generateP4Command() method, which constructs shell commands by interpolating user-supplied Perforce connection parameters (port, user, client) without proper escaping. An attacker can inject arbitrary commands through these values in a malicious composer.json declaring a Perforce VCS repository, leading to command execution in the context of the user running Composer, even if Perforce is not installed. VCS repositories are only loaded from the root composer.json or the composer config directory, so this cannot be exploited through composer.json files of packages installed as dependencies. Users are at risk if they run Composer commands on untrusted projects with attacker-supplied composer.json files. This issue has been fixed in Composer 2.2.27 (2.2 LTS) and 2.9.6 (mainline).
CVE-2026-40261: Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::syncCodeBase() method, which appends the $sourceReference parameter to a shell command without proper escaping, and additionally in the Perforce::generateP4Command() method as in GHSA-wg36-wvj6-r67p / CVE-2026-40176, which interpolates user-supplied Perforce connection parameters (port, user, client) from the source url field without proper escaping. An attacker can inject arbitrary commands through crafted source reference or source url values containing shell metacharacters, even if Perforce is not installed. Unlike CVE-2026-40176, the source reference and url are provided as part of package metadata, meaning any compromised or malicious Composer repository can serve package metadata declaring perforce as a source type with malicious values. This vulnerability is exploitable when installing or updating dependencies from source, including the default behavior when installing dev-prefixed versions. This issue has been fixed in Composer 2.2.27 (2.2 LTS) and 2.9.6 (mainline). If developers are unable to immediately update, they can avoid installing dependencies from source by using --prefer-dist or the preferred-install: dist config setting, and only use trusted Composer repositories as a workaround.
CVE-2026-45793: Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUB_TOKEN values using the ghs_<id>_<base64url-JWT> format can contain -, fail validation, and be disclosed to stderr or CI logs. This issue is fixed in versions 1.10.28, 2.2.28, and 2.9.8.
CVE-2026-59944:
CVE-2026-59946: Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package install directory and cause Composer's binary installation flow to chmod an existing host file to a world-readable and world-executable mode during composer install, update, or require. This issue is fixed in versions 2.2.29 and 2.10.2.
CVE-2026-59947: Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug output because AuthHelper, Url::sanitize, and ProcessExecutor did not sanitize username-only URL credentials. This issue is fixed in versions 2.2.29 and 2.10.2.
CVE-2026-59948: Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packagist.org or Private Packagist can cause Composer to write attacker-controlled files outside the vendor directory and outside the project during install or update by using an invalid package name that is not correctly validated before dependency-resolution results are written or installed. This issue is fixed in versions 2.2.29 and 2.10.2.

2 issues postponed or untriaged:

CVE-2023-43655: (needs triaging) Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice.
CVE-2025-67746: (postponed; to be fixed through a stable update) Composer is a dependency manager for PHP. In versions on the 2.x branch prior to 2.2.26 and 2.9.3, attackers controlling remote sources that Composer downloads from might in some way inject ANSI control characters in the terminal output of various Composer commands, causing mangled output and potentially leading to confusion or DoS of the terminal application. There is no proven exploit and this has thus a low severity but we still publish a CVE as it has potential for abuse, and we want to be on the safe side informing users that they should upgrade. Versions 2.2.26 and 2.9.3 contain a patch for the issue.

Created: 2026-04-15 Last update: 2026-09-01 05:00

debian/patches: 13 patches to forward upstream low

Among the 19 debian patches available in version 2.11.1-1 of the package, we noticed the following issues:

13 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-10-31 11:30

testing migrations

excuses:
- Migration status for composer (2.10.3-1 to 2.11.1-1): BLOCKED: Rejected/violates migration policy/introduces a regression
- Issues preventing migration:
- ∙ ∙ Autopkgtest for composer/2.11.1-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, riscv64: Pass, s390x: Pass
- ∙ ∙ Autopkgtest for php-proxy-manager/2.11.1+1.0.19-3: i386: Pass ♻, loong64: Pass ♻ (reference ♻)
- ∙ ∙ Autopkgtest for symfony/7.4.21+dfsg-1: loong64: Regression ♻ (reference ♻)
- ∙ ∙ Too young, only 3 of 5 days old
- Additional info (not blocking):
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/c/composer.html
- ∙ ∙ Reproduced on amd64 - info
- ∙ ∙ Reproduced on arm64 - info
- ∙ ∙ Reproduced on armhf - info
- ∙ ∙ Reproduced on i386 - info
- Not considered

news

[2026-10-30] Accepted composer 2.11.1-1 (source) into unstable (David Prévot)
[2026-10-29] Accepted composer 2.11.0-1 (source) into unstable (David Prévot)
[2026-10-23] Accepted composer 2.11.0~rc1-1 (source) into experimental (David Prévot)
[2026-09-01] composer 2.10.3-1 MIGRATED to testing (Debian testing watch)
[2026-08-28] Accepted composer 2.10.3-1 (source) into unstable (David Prévot)
[2026-07-07] composer 2.10.2-1 MIGRATED to testing (Debian testing watch)
[2026-07-05] Accepted composer 2.10.2-1 (source) into unstable (David Prévot)
[2026-06-13] composer 2.10.1-2 MIGRATED to testing (Debian testing watch)
[2026-06-11] Accepted composer 2.10.1-2 (source) into unstable (David Prévot)
[2026-06-09] composer 2.10.1-1 MIGRATED to testing (Debian testing watch)
[2026-06-06] composer 2.10.0-1 MIGRATED to testing (Debian testing watch)
[2026-06-05] Accepted composer 2.10.1-1 (source) into unstable (David Prévot)
[2026-06-01] Accepted composer 2.10.0-1 (source) into unstable (David Prévot)
[2026-05-28] composer 2.9.8-1 MIGRATED to testing (Debian testing watch)
[2026-05-24] Accepted composer 2.5.5-1+deb12u5 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: David Prévot)
[2026-05-24] Accepted composer 2.8.8-1+deb13u3 (source) into proposed-updates (Debian FTP Masters) (signed by: David Prévot)
[2026-05-24] Accepted composer 2.10.0~rc2-1 (source) into experimental (David Prévot)
[2026-05-13] Accepted composer 2.10.0~rc1-3 (source) into experimental (David Prévot)
[2026-05-13] Accepted composer 2.9.8-1 (source) into unstable (David Prévot)
[2026-05-11] composer REMOVED from testing (Debian testing watch)
[2026-05-04] Accepted composer 2.5.5-1+deb12u4 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: David Prévot)
[2026-05-04] Accepted composer 2.8.8-1+deb13u2 (source) into proposed-updates (Debian FTP Masters) (signed by: David Prévot)
[2026-04-19] Accepted composer 2.10.0~rc1-2 (source) into experimental (David Prévot)
[2026-04-17] composer 2.9.7-1 MIGRATED to testing (Debian testing watch)
[2026-04-15] Accepted composer 2.9.7-1 (source) into unstable (David Prévot)
[2026-04-06] Accepted composer 2.10.0~rc1-1 (source) into experimental (David Prévot)
[2026-02-01] composer 2.9.5-1 MIGRATED to testing (Debian testing watch)
[2026-01-30] Accepted composer 2.9.5-1 (source) into unstable (David Prévot)
[2026-01-27] composer 2.9.4-1 MIGRATED to testing (Debian testing watch)
[2026-01-25] Accepted composer 2.9.4-1 (source) into unstable (David Prévot)

1
2

bugs [bug history graph]

all: 0

links

homepage
lintian
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2.10.2-1
2 bugs

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers

Report problems to the tracker.debian.org pseudo-package in the Debian BTS.

Documentation — Bugs — Git Repository — Contributing